Alcatel 9000 Podręcznik Użytkownika Pobierz pdf (Strona 573)

100

101

Configuring ACLs Configuring ACLs

OmniSwitch 6800/6850/9000 Network Configuration Guide June 2006 page 27-9

Creating Policy Conditions For ACLs

A policy condition for IP filtering may include a particular source IP address, destination IP address,

source IP port, or destination IP port. Or, the condition may simply refer to the network group, MAC

group, port group, or service group. Typically ACLs use group keywords in policy conditions. A single

rule, therefore, filters traffic for multiple addresses or ports.

For example:

-> policy port group pgroup1 3/1-2 4/3 5/4

-> policy condition c2 source port group pgroup1

In this example, a Layer 2 condition (c2) specifies that traffic matches the ports included of the pgroup1

port group. The condition also specifies that the port group is a source group. Any traffic coming in on

ports 1 or 2 on slot 3, port 3 on slot 4, or port 4 on slot 5 will match condition c2.

For more information about condition groups, see “Creating Condition Groups For ACLs” on page 27-8.

The following table lists the keywords for the policy condition command that are typically used for the

different types of ACLs:

Note that the individual address, service, or port cannot be used in conjunction with the same type of

condition group. For example, you cannot specify in the same rule both a source MAC address and a

source MAC group.

Creating Policy Actions For ACLs

A policy action for IP filtering specifies a disposition, that is, whether the flow is accepted or denied on

the switch. To create a policy action, use the policy action command. Use the disposition keyword to

define whether the flow is accepted (accept) or denied (deny). For example:

-> policy action a1 disposition accept

If you do not specify a disposition for the policy action, the default (accept) will be used.

Layer 2 ACL Condition

Keywords

Layer 3/4 ACL Condition

Keywords

Multicast ACL Condition

Keywords

source mac

source mac group

destination mac

destination mac group

source vlan

source port

source port group

destination port

destination port group

ethertype

802.1p

source ip

source network group

destination ip

destination network group

source ip port

destination ip port

service

service group

ip protocol

destination port

destination port group

icmptype

icmpcode

tos

dscp

source tcp port

destination tcp port

source udp port

destination udp port

established

tcpflags

multicast ip

multicast network group

destination ip

destination vlan

destination port

destination port group

destination mac

destination mac group

1 2 ... 568 569 570 571 572 573 574 575 576 577 578 ... 701 702

Komentarze do niniejszej Instrukcji

Brak uwag

Alcatel 9000 Podręcznik Użytkownika Strona 573

Komentarze do niniejszej Instrukcji

Powiązane produkty i podręczniki dla Oprogramowanie Alcatel 9000